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MSTING OF PENDING CLAIMS 

The following listing of claims will replace all prior 
claims in this application: 

1. (Currently Amended) A communications network 
ascertaining the integrity of a first communications network and 
security risks across a perimeter of the first communications 
comprising: 

identifying a plurality of routes that define the first 

identifying a plurality of hosts associated with the first 
as a function of the plurality of routes; 

receiving a census of the first communications network 
plurality of hosts to determine a topology of the first communicatioijis 

probing at least one first host of the plurality hosts of the 
network by generating and_t ransmUting a packet to the first hos 
selected from the census results and the packet having at least i 
second host which is associated with a second communications 
source address is selected independent of any request from the 
host; and 

determining a security characteristic of the probed first 
response by the probed first host in receiving the packet, the 
a measure of connectivity between the first communications 
communications network, the measure of connectivity being an 
between the first communications network and the second 



versions, and listings,, of 



security method for 
identifying potential 
Aetwork, the method 



secur ty 



2. (Previously Presented) The method of claim 1 wherein 
the second host is a return IP address external to the first 



communi nations 



3. (Previously Presented) The method of claim 2 
probed first host to the receipt of the packet includes transmitting 
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network; 

network 



cottinumcations 



as a function of the 

network; 
first communications 
;, the first host being 
i source address of a 
network, wherein the 
host to the first 



second 



host 



as a function of a 
characteristic being 
neltwork and the second 
indication of connectivity 
commuilications network. 



the source address of 
network. 



wherein the response of the 
a second packet, the 
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second packet being derived using at least a portion of informatio|i 
packet. 

4. (Previously Cancelled). 



5. (Previously Cancelled), 



6. (Previously Presented) The method of claim 2 
connectivity i$ determined by the further operation of: 

monitoring the probed first host to determine the response 
includes a transmission of a second packet from the probed first hosi 
the return IP address, generating a security alert message identifying 
as a security risk. 



wherein the measure of 



7. (Previously Presented) The method of claim 3 
communications network and the second communications network 
levels. 

8, (Previously Presented) The method of claim 3 wherein 
is a TCP packet which returns a TCP packet in response thereto. 



9. (Previously Presented) The method of claim 3 wherein 
UDP packet or an ICMP packet, which returns either a UDP packet 
response thereto. 



10. (Currently Amended) A method for analyzing 
perimeter of a first communications network utilizing a 
comprising: 

receiving a census of the first communications network; 
aerating and transmitting, from the security host, a 
host of a second communications network to a particular one hosi 



from the received 



and if the response 
to the second host at 
the probed first host 



wherein the first 
Aave different security 



he transmitted packet 



the second packet is a 
or ICMP packet in 



network security across a 
security host, the method 



pabket associated with a 
of a plurality of hosts 



3 
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being 



tie 



internal to the first communications network, the internal host 
census, and the packet having an IP source address associated with 
communications network, wherein the IP source address is selected 
request from the host of the second communications network to the 
first communications network; and 

determining a security characteristic of the particular one i 
communications network as a function of a response by the internal 
the packet, the security characteristic being a measure of ^ 
communications network and the second communications 
connectivity being an indication of connectivity between the 
network and the second communications network. 



internal ! 



connectivity 



selected from the 
host of the second 
independent of any 
internal host of the 



host of the first 
lost to the receipt of 
between the first 
network, the measure of 
communications 



first 



11. (Previously Presented) The method of claim 10 wtoxein the measure of 
connectivity is a function of whether the internal ho* of the irst communications 
network communicates with the host of the second communications network, and the 
measure of connectivity being determined by the further operation of: 

monitoring the internal host to determine the response, and if the response 
includes a transmission of a second packet, utilizing the TP soujee address, from the 
internal host to the host of the second communications network, *" 
alert message identifying the internal host as a security risk. 



generating a security 



12. (Previously Presented) The method of claim 1 1 wherein 
derived using at least a portion of information from the transmitted 



jacket. 



13. (Previously Cancelled). 

14. (Previously Presented) The method of claim 12 wli 
dual-homed host. 



the second packet is 



herein the internal host is a 



4 
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wherein 



15. (Previously Presented) The method of claim 11 
characteristic includes an indication that the internal host is outside 
provided by a firewall associated with the first commijnications 



aiy 



security 



communications 1 



16. (Currently Amended) A communications system for asc 
of a first communications network and identifying potential 
perimeter of the first communications network, the communications 
a first plurality of computers associated with the first 
a second plurality of computers associated with a 
network; and 

a security host computer which determines a security 
computer from the first plurality of computers, the security 
of connectivity between the first communications networl: 
communications network by probing the first computer by 



ertaining the integrity 
risks across a 
jystem comprising: 
network; 
secdnd communications 



characteristic of a first 
characteristic being a measure 
and the second 
generati ng and t ransmitting a 



packet to the first computer, the first computer being selected from 
communications network and the packet being generated as a 
source address associated with a second computer of the second p 
wherein said IP source address is selected independent of any 
computer to the first computer, and an IP address associated with 
determining the measure of connectivity as a function of a response 
to receiving the packet, the measure of connectivity being an 
between the first communications network and the second 



common cations 



17. (Previously Presented) The communications system of 
security host computer is associated with the first communications 



18. (Previously Presented) The communications system of 
response of the first computer to the receipt of the packet include; 
packet, the second packet being derived using at least a portion 
received packet. 



of 



the security 
security measures 
network. 



a census of the first 
action of both an IP 
Lurality of computers, 
from the second 
first computer, and 
of the first computer 
of connectivity 
network. 



rec uest 



tte 



indication 



claim 16 wherein the 
ietwork. 



claim 17 wherein the 
transmitting a second 
information from the 
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19. (Previously Presented) The communications system of c 
security host computer determines the measure of connectivity by 
first computer to determine the response, and if the response includes 
the second packet from the probed host, generating a security alert 
the first computer as a security risk. 



aim 18 wherein the 
monitoring the probed 
the transmission of 
message identifying 



20. (Previously Presented) The communications system of 
first communications network is an intranet and the second 
an Internet, and the first communications network and the 
network have different sec*irity levels. 



claim 



communications 



seccnd 



21* (Currently Amended) A security host computer for 
of a first communications network and identifying potential s 
perimeter of the first communications network, the security host co 

means for performing a census of the first 
determining a topology of the first communications network, the 
by at least one computer, 

means for probing the at least one computer by g enerati 



ascertaining i 



the integrity 
risks across a 
:cr comprising: 
network and 
tobology being defined 



security 



rrputc 



communic ations 



census 



an 



packet to the computer, the computer being selected from the 
packet being generated as a function of (i) the topology, (ii) 
associated with a particular host computer associated with a 
network, wherein the IP source address is selected independent of 
second computer to the first computer, and (iU) an IP address 
computer, the second communications network being separate 
communications network; and 

a monitor for determining a security level of the computer 
response by the computer to the receipt of the packet, and the 
measure of connectivity between the first communications 
communications network, the measure of connectivity being an 
between the first communications network and the second common 



17 wherein the 
network is 
communications 



and t ransmitting a 
results and the 
IP source address 
seclond communications 
any request from the 
associated with the 
from the first 



as a function of a 
Security level being a 
network and the second 
indication of connectivity 
cations network. 
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22. (Previously Presented) The security host computer of 
measure of connectivity is determined by monitoring the computer' 
response includes a transmission of a second packet, utilizing the IP 
the computer, a security alert message identifying the computer 
generated. 



cjlaim 21 wherein the 
response, and if the 
source address, from 
is a security risk i$ 



23. (Previously Presented) The security host computer of 
first communications network and the second communications 
security levels. 



24. (Currently Amended) A machine-readable medium ha\ing stored thereon a 
plurality of instructions, the plurality of instructions including instructions that, when 
executed by a machine, cause the machine to perform of a method 



cjlaim 22 wherein the 
network have different 



communications network's integrity and identifying potential security risks across a 
perimeter of the first communications network by receiving a census of the first 
communications network; probing a first host of the first commw lications network by 
generating and transmitting a packet to the first host, the host being selected fiom the 
census results and the packet being derived as a function of a 
communications network and the packet having a source address whjich is associated with 
a second host of a second communications network, wherein tie source address is 
selected independent of any request from the second host to 
determining the first communications network's integrity as a function of a response by 
the probed host in receiving the packet wherein the response m iicates a measure of 
connectivity between the first communications network communicates and the second 
communications network, and the measure of connectivity be: 
connectivity between the first communications network and the second communications 
network. 

25. (Previously Cancelled). 



for analyzing a first 
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26. (Previously Presented) The machine-readable medium 
the response of the probed first host to the receipt of the packet 
second packet, the second packet being derived using at least a po|tion 
from the received packet 



claim 24 wherein 
includes transmitting a 
of information 



cf 



27. (Previously Presented) The machine-readable medium 
the first communications network is an intranet, and the second communications 
is an Internet. 



claim 26 wherein 
network 
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